System and method for unsupervised abstraction of sensitive data for detection model sharing across entities

ABSTRACT

An abstraction system for generating a standard customer profile in a data processing system has a processing device and a memory. The abstraction system may receive customer data from a computing device over a network, the customer data including information for a plurality of customers and perform unsupervised learning on the customer data to produce a plurality of clusters of customers with a plurality of features in common, determine that a cluster represents a standard customer and store a plurality of standard customer profiles based on the determined standard customers. The abstraction system may also provide the standard customer profiles to a cognitive system for generating synthetic transaction data based on the standard customer, generate a detection model for detecting activity based on the synthetic transaction data, and distribute the detection model to each of the computing devices over the network.

TECHNICAL FIELD

The present invention relates generally to a cognitive systemimplementing a transaction data simulator, and more particularly tosystems and methods for unsupervised abstraction of sensitive data forsharing of detection models across entities.

BACKGROUND

A financial crime detection system, e.g., IBM® Financial Crimes AlertsInsight with Watson™, can utilize cognitive analytics to help banks todetect money laundering and terrorist financing. The cognitive analyticsdifferentiate “normal” financial activities from “suspicious”activities, and use the differentiation information to build apredictive model for banks. A large set of real financial customer datais required to train the predictive model.

Since the real customer data is very sensitive, only a limited amount ofreal customer data can be provided by banks. However, in order to bestsimulate fraudulent situations and detect different types of financialcrimes, more simulated customer data, e.g., transaction data fortraining, which looks realistically, could produce a better predictivemodel.

SUMMARY

According to some embodiments, the present disclosure describes acomputer-implemented method for generating a standard customer profilein a data processing system. The method includes performing steps by aprocessing device, including receiving customer data from a computingdevice over a network, the customer data including information for aplurality of customers, and performing unsupervised learning on thecustomer data to produce a plurality of clusters of customers with aplurality of features in common, and that a cluster represents astandard customer and storing a plurality of standard customer profilesbased on the determined standard customers. The method additionallyincludes providing the plurality of standard customer profiles to acognitive system for generating synthetic transaction data based on thestandard customer, generating a detection model for detecting activitybased on the synthetic transaction data, and distributing the detectionmodel to each of the computing devices over the network.

According to other embodiments, the present disclosure describes anabstraction system for generating a standard customer profile in a dataprocessing system. The abstraction system may include a processingdevice and a memory. The abstraction system may receive customer datafrom a computing device over a network, the customer data includinginformation for a plurality of customers and perform unsupervisedlearning on the customer data to produce a plurality of clusters ofcustomers with a plurality of features in common, determine that acluster represents a standard customer and store a plurality of standardcustomer profiles based on the determined standard customers. Theabstraction system may also provide the standard customer profiles to acognitive system for generating synthetic transaction data based on thestandard customer, generate a detection model for detecting activitybased on the synthetic transaction data, and distribute the detectionmodel to each of the computing devices over the network.

According to additional embodiments, the present disclosure describes anon-transitory computer readable medium having stored thereoninstructions for generating a standard customer profile in a dataprocessing system, which when executed by at least one processing deviceperforms disclosed methods consistent with disclosed embodiments

Additional features and advantages of this disclosure will be madeapparent from the following detailed description of illustrativeembodiments that proceeds with reference to the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing and other aspects of the present invention are bestunderstood from the following detailed description when read inconnection with the accompanying drawings. For the purpose ofillustrating the invention, there is shown in the drawings embodimentsthat are presently preferred, it being understood, however, that theinvention is not limited to the specific instrumentalities disclosed.Included in the drawings are the following Figures:

FIG. 1 depicts a block diagram of one illustrative embodiment of acognitive system implementing a transaction data simulator in a computernetwork, consistent with disclosed embodiments;

FIG. 2 depicts a block diagram of an example data processing system inwhich aspect of the illustrative embodiments may be implemented,consistent with disclosed embodiments;

FIG. 3 depicts a schematic diagram of one illustrative embodiment of theabstraction system, consistent with disclosed embodiments;

FIG. 4 depicts an exemplary flow from customer data to standardcustomers, consistent with disclosed embodiments;

FIG. 5 depicts a flow chart of one illustrative embodiment of a methodof abstracting data to generate standard customers, consistent withdisclosed embodiments;

FIG. 6 depicts a schematic diagram of example standard customersproduced by the abstraction system, consistent with disclosedembodiments;

FIG. 7 depicts a schematic diagram of one illustrative embodiment of thetransaction data simulator, consistent with disclosed embodiments;

FIG. 8 depicts a flow chart of one illustrative embodiment of a methodof simulating transaction data, consistent with disclosed embodiments;and

FIG. 9 depicts a schematic diagram showing a plurality of synthetictransaction data entries, consistent with disclosed embodiments.

DETAILED DESCRIPTION

As an overview, a cognitive system is a specialized computer system, orset of computer systems, configured with hardware and/or software logic(in combination with hardware logic upon which the software executes) toemulate human cognitive functions. These cognitive systems applyhuman-like characteristics to conveying and manipulating ideas which,when combined with the inherent strengths of digital computing, cansolve problems with high accuracy and resilience on a large scale. IBMWatson™ is an example of one such cognitive system which can processhuman readable language and identify inferences between text passageswith human-like accuracy at speeds far faster than human beings and on amuch larger scale. In general, such cognitive systems are able toperform the following functions:

-   -   Navigate the complexities of human language and understanding    -   Ingest and process vast amounts of structured and unstructured        data    -   Generate and evaluate hypotheses    -   Weigh and evaluate responses that are based only on relevant        evidence    -   Provide situation-specific advice, insights, and guidance    -   Improve knowledge and learn with each iteration and interaction        through machine learning processes    -   Enable decision making at the point of impact (contextual        guidance)    -   Scale in proportion to the task    -   Extend and magnify human expertise and cognition    -   Identify resonating, human-like attributes and traits from        natural language    -   Deduce various language specific or agnostic attributes from        natural language    -   High degree of relevant recollection from data points (images,        text, voice) (memorization and recall)    -   Predict and sense with situation awareness that mimics human        cognition based on experiences    -   Answer questions based on natural language and specific evidence

In one aspect, the cognitive system can be augmented with a transactiondata simulator, to simulate a set of customer transaction data from afinancial institution, e.g., a bank. The simulated customer transactiondata, even if it is not “actual” customer transaction data from thefinancial institution, can be used to train the predictive model foridentifying financial crimes.

The transaction data simulator combines a multi-layered unsupervisedclustering approach with interactive reinforcement learning (IRL) modelto create a large set of intelligent agents that have learned to behavelike “standard customers.”

In an embodiment, the multi-layered unsupervised clustering approachcreates a large set of standard customer transaction behaviors(extracted from real customer transaction data provided by a bank),using information including hundreds of attributes of “standardcustomers” over varying periods of time. Each standard customertransaction behavior can be associated with a group of customers havingsimilar transaction characteristics. An intelligent agent generates anartificial customer profile, and selects one of standard customertransaction behaviors to be combined with the generated artificialcustomer profile. In this way, the intelligent agent can simulate a“standard customer,” and learn to behave like the “standard customer.”The intelligent agent is then provided with a period of time (e.g., tenyears), during which the intelligent agent can observe an environment,e.g., past behaviors of the represented “standard customer”) and learnto perform “fake” customer transactions which are similar to standardcustomer transaction behavior of the represented “standard customer.”Each factor of the standard customer transaction behavior can bestatistic data. For example, the transaction amount of the standardcustomer transaction behavior can be a range of values, e.g., thetransaction amount of the standard customer transaction behavior is$20-$3,000. The transaction location of the standard customertransaction behavior can be provided statistically, e.g., 30% oftransaction locations are shopping malls, 50% of transaction locationsare restaurants, and 20% of transaction locations are gas stations. Thetransaction type of the standard customer transaction behavior can beprovided statistically, e.g., 20% of transaction types are checkpayment, 40% of transaction types are POS payment, 25% of transactiontypes are ATM withdrawal, and 15% of transaction types are wiretransfer. The transaction medium of the standard customer transactionbehavior can be provided statistically, e.g., 15% of transaction mediumsare cash, 45% of transaction mediums are credit card, 25% of transactionmediums are checking accounts, and 15% of transaction mediums arePayPal®.

In an embodiment, a large number of artificial customer profiles aregenerated from a plurality of real customer profile data. The realcustomer profile data can be provided by one or more banks. Each realcustomer profile can include an address of a customer; a name of acustomer (the customer can be a legal entity or individual); contactinformation such as a phone number, an email address, etc.; creditinformation, such as a credit score, a credit report, etc.; incomeinformation (e.g., an annual revenue of a legal entity, or a wage of anindividual), and the like. The real customer profile data are storedunder different categories. For example, commercial customers (i.e.,legal entities) can be divided into different categories based on thesize, product or service of the commercial customers. An artificialcustomer profile can be generated by randomly searching all the realcustomer profile data. For example, an artificial customer profile canbe generated by combining randomly selected information includingaddress, first name, second name, phone number, email address, creditscore, revenue or wage, etc. Thus, the generated artificial customerprofile extracts different pieces of information from real customerprofile data, and thus looks like a realistic customer profile.Financial transaction data is further simulated associated with eachartificial customer profile.

In an embodiment, to protect privacy of real customers, compositeinformation, such as an address, a name, etc. can be split into aplurality of parts before the random selection. For example, the address“2471 George Wallace Street” can be parsed into 3 parts: [number]“2471,” [name] “George Wallace,” and [suffix] “Street.” These parts canbe randomly selected individually to form an artificial customerprofile. In a further embodiment, the composite information of anartificial customer profile, such as an address, a name, etc. iscompared to the composite information of a real customer profile. If thesimilarity degree is greater than a predefined threshold value, then theartificial customer profile is unacceptable and needs to be updateduntil the similarity degree is less than the predefined threshold value.

FIG. 1 depicts a schematic diagram of one illustrative embodiment of acognitive system 100 implementing a transaction data simulator 110 andan abstraction system 120 in a computer network 114. The cognitivesystem 100 is implemented on one or more computing devices 112(comprising one or more processing devices and one or more memories, andpotentially any other computing device elements generally known in theart including buses, storage devices, communication interfaces, and thelike) connected to the computer network 114. The computer network 114includes multiple computing devices 112 in communication with each otherand with other devices or components via one or more wired and/orwireless data communication links, where each communication linkcomprises one or more of wires, routers, switches, transmitters,receivers, or the like. Other embodiments of the cognitive system 100may be used with components, systems, sub-systems, and/or devices otherthan those that are depicted herein. The computer network 114 includeslocal network connections and remote connections in various embodiments,such that the cognitive system 100 may operate in environments of anysize, including local and global, e.g., the Internet. The cognitivesystem 100 is configured to implement a transaction data simulator 110that can simulate standard customer transaction data 106 (i.e., astandard customer transaction behavior). The transaction data simulator110 can generate a large set of simulated customer transaction data 108based on the standard customer transaction data 106, so that thesimulated customer transaction data 108 looks like real customertransaction data. In an embodiment, the standard customer transactiondata 106 is obtained through unsupervised clustering approach. Rawcustomer data including a large amount of customer transaction data isprovided by one or more banks, and a large set of small groupsrepresenting different characteristics of bank customers are clusteredor grouped from the raw customer data through unsupervised clusteringapproach. Each small group includes transaction data from customershaving similar characteristics. For example, group A representscustomers who are single attorneys practicing patent law in New York,while group B represents customers who are married attorneys practicingcommercial law in New York.

The abstraction system 120 is implemented in hardware and/or softwareand is configured to perform unsupervised abstraction of standardcustomer transaction data 106 to produce one or more standard customersthat are abstract representations of real customers, but which do notcontain traceable customer information that could expose sensitiveinformation. In an exemplary embodiment, the abstraction system 120 isconfigured to perform repeated unsupervised learning steps to clusterand sub-cluster real customer data to produce a standard customer thatrepresents a small group of customers.

FIG. 2 is a block diagram of an example data processing system 200 inwhich aspects of the illustrative embodiments are implemented. Dataprocessing system 200 is an example of a computer in which computerusable code or instructions implementing the process for illustrativeembodiments of the present invention are located. In one embodiment,FIG. 2 represents the transaction data simulator 110, which implementsat least some of the aspects of the cognitive system 100 describedherein.

In the depicted example, data processing system 200 can employ a hubarchitecture including a north bridge and memory controller hub (NB/MCH)201 and south bridge and input/output (I/O) controller hub (SB/ICH) 202.Processing unit 203, main memory 204, and graphics processor 205 can beconnected to the NB/MCH 201. Graphics processor 205 can be connected tothe NB/MCH 201 through an accelerated graphics port (AGP).

In the depicted example, the network adapter 206 connects to the SB/ICH202. The audio adapter 207, keyboard and mouse adapter 208, modem 209,read only memory (ROM) 210, hard disk drive (HDD) 211, optical drive (CDor DVD) 212, universal serial bus (USB) ports and other communicationports 213, and the PCI/PCIe devices 214 can connect to the SB/ICH 202through bus system 216. PCI/PCIe devices 214 may include Ethernetadapters, add-in cards, and PC cards for notebook computers. ROM 210 maybe, for example, a flash basic input/output system (BIOS). The HDD 211and optical drive 212 can use an integrated drive electronics (IDE) orserial advanced technology attachment (SATA) interface. The super I/O(SIO) device 215 can be connected to the SB/ICH 202.

An operating system can run on processing unit 203. The operating systemcan coordinate and provide control of various components within the dataprocessing system 200. As a client, the operating system can be acommercially available operating system. An object-oriented programmingsystem, such as the Java™ programming system, may run in conjunctionwith the operating system and provide calls to the operating system fromthe object-oriented programs or applications executing on the dataprocessing system 200. As a server, the data processing system 200 canbe an IBM® eServer™ System P® running the Advanced Interactive Executiveoperating system or the LINUX® operating system. The data processingsystem 200 can be a symmetric multiprocessor (SMP) system that caninclude a plurality of processors in the processing unit 203.Alternatively, a single processor system may be employed.

Instructions for the operating system, the object-oriented programmingsystem, and applications or programs are located on storage devices,such as the HDD 211, and are loaded into the main memory 204 forexecution by the processing unit 203. The processes for embodiments ofthe web site navigation system can be performed by the processing unit203 using computer usable program code, which can be located in a memorysuch as, for example, main memory 204, ROM 210, or in one or moreperipheral devices.

A bus system 216 can be comprised of one or more busses. The bus system216 can be implemented using any type of communication fabric orarchitecture that can provide for a transfer of data between differentcomponents or devices attached to the fabric or architecture. Acommunication unit such as the modem 209 or network adapter 206 caninclude one or more devices that can be used to transmit and receivedata.

Those of ordinary skill in the art will appreciate that the hardwaredepicted in FIG. 2 may vary depending on the implementation. Forexample, the data processing system 200 includes several componentswhich would not be directly included in some embodiments of theabstraction system 120. However, it should be understood that atransaction data simulator 110 may include one or more of the componentsand configurations of the data processing system 200 for performingprocessing methods and steps in accordance with the disclosedembodiments.

Moreover, other internal hardware or peripheral devices, such as flashmemory, equivalent non-volatile memory, or optical disk drives may beused in addition to or in place of the hardware depicted. Moreover, thedata processing system 200 can take the form of any of a number ofdifferent data processing systems, including but not limited to, clientcomputing devices, server computing devices, tablet computers, laptopcomputers, telephone or other communication devices, personal digitalassistants, and the like. Essentially, data processing system 200 can beany known or later developed data processing system withoutarchitectural limitation.

FIG. 3 is a schematic diagram of one illustrative embodiment of theabstraction system 120. In some embodiments, the abstraction system 120may include a plurality of modules stored in the main memory 204. Theplurality of modules may be implemented in hardware and/or software. Theabstraction system 120 may include a data collection module 310, anunsupervised learning module 320, a standard customer module 330, and aboundary module 340. In some embodiments, the abstraction system 120 mayfurther include and/or be connected to one or more data repositories350.

The data collection module 310 may be configured to receive customerdata from a computing device 112. The customer data may be actualcustomer data. For example, the customer data 106 from a financialinstitution and include information such as identifying information,transaction information, etc. The customer data 106 may include avariety of features that are separately stored as individual categoriesof information. For instance, the customer data 106 may include spendingdata, payment data, time period data, location data, etc. In someembodiments, the data collection module 310 may be configured to collectdata from a plurality of computing devices 112, such as from a pluralityof financial institutions. In some embodiments, the data collectionmodule 310 may be configured to perform a filtering process to creategroups of data for analysis. For example, the data collection module 310may use a manual or automatic categorization of customers to create apool of similar customers (e.g., individuals, corporations, retail,service, etc.).

The unsupervised learning module 320 may be configured to performunsupervised learning on a data set. The unsupervised learning may be,for example, a clustering algorithm configured to group one or moresubsets of data based on patterns, trends, and/or other similaritiesfound in the data. The unsupervised learning module 320 may beconfigured to perform a clustering process without manual input into thegroupings (thus “unsupervised” learning). As a result, the clusters maybe free from biases of how a user may believe that data should begrouped.

The standard customer module 330 may be configured to extract clustersor groups from the output of the unsupervised learning module in orderto generate and store a standard customer profile that is based on theinput data from the data collection module. The standard customer module330 may be configured to perform a general sanity check of a cluster(e.g., sample size, statistical significance, etc.) to determine when acluster or sub-cluster can be considered a standard customer.

The boundary module 340 may be configured to further divide collectedcustomer data according to one or more boundaries. For instance, theboundary module 340 may be a statistic and/or time slicing moduleconfigured to further filter data according to one or more parameterssuch that an individual customer and/or standard customer can beanalyzed from different viewpoints. For instance, the boundary module340 may create subcategories of data based on two or more features(e.g., transaction information and time information). For instance,customer data collected by the data collection module 310 may providetransaction information for a customer over a year. The boundary module340 may place time period boundaries on the data over the year toidentify additional features that can be considered data points. Forinstance, the boundary module 340 may create categories for “holidayspending,” “vacation spending,” “lunchtime spending,” “savings periods,”etc. The boundary module 340 may thus be used to further subdivide andcategorize customer data. The boundary module 340 may apply theseprinciples to standard customers in some embodiments. For example, theboundary module 340 may derive additional standard customer behaviorsfrom an established customer behavior by groping data at certain timeperiods or based on other statistical boundaries.

FIG. 4 is a diagram of a process flow for using unsupervised learning oncustomer data 106 to produce one or more standard customer profilesusing data abstraction. As a result of the data abstraction, thecustomer data 106 is abstracted/aggregated to the point that it can besaved and stored locally, without privacy issues. In some embodiments,the data collection module 310 may receive customer data 106 from one ormore computing devices 112. The data collection module 310 may performinitial filtering 405 of the data. For instance, the data collectionmodule 310 may perform an RFM (recency, frequency, monetary value)analysis to sub-group data from the customer data 106. The unsupervisedlearning module 320 may perform a clustering process 410 to create oneor more data clusters 415. The one or more data clusters 415 may begroupings of customers based on the unsupervised learning algorithmapplied as the clustering process 410. The clusters 415 may be based ona similarity of one or more features in the customer data. For instance“Cluster 1” of the clusters 415 may be all customers in a particulargeographic area while “Cluster 2” of the clusters 415 may be allcustomers over a particular age, that spend a certain amount per year,that deposit less than a certain amount per year, etc. The unsupervisedlearning 410 may produce any number of clusters 415 and a customer maybe in more than one of the clusters.

The unsupervised learning module 320 may perform additional clusteringprocesses 420 to create one or more sub-clusters 425. This unsupervisedlearning module 320 may generate sub-clusters 425 through furthergrouping of customers based on an additional similarity in the data. Forinstance, for customers in an initial cluster 415 based on location, asub-cluster may be based on age, job, spending, transaction details,etc. The unsupervised learning 420 to produce sub-clusters 425 may berepeated any number of times until the standard customer module 330identifies a cluster of sub-cluster that is considered a standardcustomer 430. For instance, the standard customer module 330 may selectclusters that satisfy certain criteria, such as number of customersand/or similar features in a group. The customer module 330 may storethese as standard customers 430 as profiles for use as “abstract”customers that can be used to reproduce realistic customer data. Forinstance, the standard customers 430 may be provided to the cognitivesystem 100 for use with the transaction data simulator 110.

FIG. 5 is an exemplary process 500 for converting customer data intoabstract standard customers for use in generating synthetic transactiondata that is realistic but cannot be traced back to the actual data. Instep 510, the data collection module 310 receives and filters customerdata. In step 520, the unsupervised learning module 320 applies analgorithm to data to produce clusters of customers based on theirsimilarity in at least one feature. In step 530, the unsupervisedlearning module performs unsupervised learning on clusters to producesub-clusters of customers and customer features. The clustering processmay be repeated as necessary to produce smaller and more specific groupsof customers. In at least some embodiments, each unsupervised learningstep adds a data feature to a grouping of customers.

In step 540, the standard customer module 330 determines standardcustomers based on the clusters and sub-clusters of data throughunsupervised learning. The standard customer module 330 may use a rulesdatabase to determine when a cluster is considered a standard customer.For instance, the standard customer module 330 may compare a number ofdata features and a number of customers in a grouping to thresholdvalues to determine whether the group has sufficient and/or narrowenough data to be considered a standard customer.

In step 550, the boundary module 340 may further derive additionalstandard customers. For example, in some embodiments, the boundarymodule 340 may add customers to standard customer profiles based on aportion of their data fitting into a customer profile. For instance, theboundary module 340 may perform a bounding operation on customer data toidentify customers that fit into standard customer profiles when certainboundaries are applied. For instance, the boundary module 340 may selecta cluster or a standard customer profile and perform additional analysisto view the evolution of behavior of a customer when the element of timeis considered. In other examples, the boundary module 340 may apply astatistical boundary to derive additional standard customers.

In step 560, the abstraction system 120 may provide the standardcustomers to the cognitive system 100. The cognitive system may use thestandard customers as an input to create new, synthetic transaction data108 that fits in the standard customer behavior, but is not traceableback to the original, actual customer data. As a result, real customerdata 106 is used to create artificial customer data 108 that can berelied upon as being realistic but which does not expose the actualsensitive customer data.

FIG. 6 is a representation of standard customers 610, 620 that may begenerated through one or more disclosed processes based on customer data106. In an exemplary embodiment, the standard customers 610, 620 includea plurality of features that describe the customers that are present inthe grouping that makes up the standard customer 610, 620. For instance,feature 1 may include a customer age, feature 2 may include customerincome, feature 3 may include customer spending, etc. At least some ofthe features that make up the standard customers 610, 620 may berepresented as a distribution of data. For instance, the distributionmay be a distribution of data with data points for each customer in thestandard customer profile. The distribution is thus a representation ofthe actual customer data, but it is a generic, statisticalrepresentation that is abstracted such that the actual data is notexposed.

FIG. 7 depicts a schematic diagram of one illustrative embodiment of thetransaction data simulator 110. The transaction data simulator 110utilizes reinforcement learning techniques to simulate financialtransaction data. The transaction data simulator 110 includesintelligent agent 702, and environment 704. The intelligent agent 702randomly selects a standard transaction behavior 720 (i.e. goal 720)representing a group of “customers” having similar transactioncharacteristics, and associates the standard transaction behavior with arandomly selected artificial customer profile 718. The intelligent agent702 takes an action 712 in each iteration. In this embodiment, theaction 712 taken in each iteration includes conducting a plurality oftransactions in a single day. Each transaction has the informationincluding transaction type (e.g., Automated Clearing House (ACH)transfer, check payment, Wire transfer, Automated Teller Machine (ATM)withdrawal, Point of Sale (POS) payment, etc.); transaction amount;transaction time; transaction location; transaction medium (e.g., cash,credit card, debit card, PayPal®, checking account, etc.); the secondparty who is related to the transaction (e.g., a person who receives thewire transferred payment), and the like. The environment 704 takes theaction 712 as input, and returns reward 714 (or feedback) and state 716from environment 704 as the output. The reward 714 is the feedback bywhich the success or failure of the action 712 is measured. In thisembodiment, the environment 704 compares the action 712 with goal 720(e.g., standard transaction behavior). If the action 712 deviates fromthe goal 720 beyond a predefined threshold, then the intelligent agent702 is penalized, while if the action 712 deviates from the goal 720within a predefined threshold (i.e., the action 712 is similar to thegoal 720), the intelligent agent 702 is rewarded. The action 712 iseffectively evaluated, so that the intelligent agent 702 can improve thenext action 712 based on the reward 714. In this embodiment, theenvironment 704 is a set of all old actions taken by the intelligentagent 702, i.e., the environment 704 is a set of all old simulatedtransactions. The intelligent agent 702 observes the environment 704,and gets information about the old transactions, e.g., the number oftransactions that have been made within a day, a week, a month, or ayear; each transaction amount, account balance, each transaction type,and the like. The policy engine 706 can adjust the policy based on theobservations, so that the intelligent agent 702 can take a better action712 in the next iteration.

The intelligent agent 702 further includes policy engine 706, configuredto adjust a policy based on the state 716 and the reward 714. The policyis a strategy that the intelligent agent 702 employs to determine thenext action 712 based on the state 716 and the reward 714. The policy isadjusted, aiming to get a higher reward 714 for the next action 712taken by the intelligent agent 702. The policy includes a set ofdifferent policy probabilities or decision-making probabilities whichcan be used to decide whether a transaction is going to be performed ina particular day or not, the number of transactions per day, transactionamount, transaction type, transaction party, etc. In reinforcementlearning model, outcome of events are random, and a random numbergenerator (RNG) is a system that generates random numbers from a truesource of randomness. In an example, the maximum number of transactionsper day is 100, and the maximum transaction amount is $15 million. Inthe first iteration, a random transaction with transaction amount of $15million to Zimbabwe is made by the intelligent agent 702. This action712 deviates far from the goal 720 (e.g., transaction made by marriedattorneys practicing commercial law in Maine), and thus this action 712is penalized (i.e., the reward 714 is negative). The policy engine 706is trained to adjust the policy, so that a different transaction whichis closer to the goal 720 can be made. With more iterations,transactions which are similar to the goal 720 can be simulated by the“smarter” policy engine 706. As shown in FIG. 8, a plurality oftransactions from the customer “James Culley” are simulated, and thesimulated transaction data is similar to the goal 720.

As shown in FIG. 2, in an embodiment, one feedback loop (i.e., oneiteration) corresponds to one “day” of actions (i.e., one “day” ofsimulated transactions). During a period of time, e.g., ten years, theintelligent agent 702 learns how to take an action 712 to get a reward714 as high as possible. The number of iterations corresponds to theduration of time. For example, ten years correspond to 10×365=3650iterations. Reinforcement learning model judges the actions 712 by theresults that the actions 712 produce. It is goal 720 oriented, and itsaim is to learn sequences of actions 712 that will lead the intelligentagent 702 to achieve its goal 720, or maximize its objective function.

In an embodiment, the transaction data simulator 110 further includesupdater 710. A new action 712 is performed in each iteration. Theupdater 710 updates the environment 704 with the action 712 taken by theintelligent agent 702 after each iteration. The action 712 taken in eachiteration is added into the environment 704 by the updater 710. In anembodiment, the transaction data simulator 110 further includes pruner708, configured to prune the environment 704. In an embodiment, thepruner 708 can remove one or more undesired actions. For example,actions 712 which are taken in the first ten iterations are removed,because these ten iterations deviate far from the goal 720, and thedegree of similarity is below a predefined threshold. In anotherembodiment, a full re-initialization of the transaction data simulator110 can be performed to remove all the accumulated actions in theenvironment 704, so that the intelligent agent 702 can start over again.

FIG. 8 illustrates a flow chart of one illustrative embodiment showing amethod 800 of simulating transaction data. At step 802, standardcustomer transaction behavior data is provided as goal 720. The standardcustomer transaction behavior represents a group of customers havingsimilar transaction characteristics. The standard customer transactionbehavior is obtained through unsupervised clustering approach.

At step 804, an action 712 is taken to conduct a plurality oftransactions in an iteration representing e.g., a single day (e.g., 100transactions per day). Each transaction has the information includingtransaction type, transaction amount, transaction time, transactionlocation, transaction medium, the second party who is associated withthe transaction, and the like.

At step 806, the environment 704 compares the goal 720 with the action712 taken in this iteration, rewards or penalizes the action 712 basedon similarity to or deviation from the goal 720. The threshold or ruleto decide whether the action 712 is similar to the goal 720 or not, ispredefined, and can be adjusted based on how similar to the goal 720 theuser prefers.

At step 808, the environment 704 is updated to include the action 712 inthe present iteration. The environment 704 includes a set of all oldactions.

At step 810, the policy engine 706 adjusts a policy for determining thenext action 712 based on the reward 714 (i.e., reward or penalty). Thepolicy is made based on a variety of factors, e.g., probability ofoccurrence of a transaction, the number of transactions per day,transaction amount, transaction type, transaction party, transactionfrequency of each transaction type, an upper bound and a lower bound foreach transaction, transaction medium, and the like. The policy canadjust weights of these factors based on the reward 714 in eachiteration.

At step 812, in a new iteration, the intelligent agent 702 takes a newaction 712. The steps 804 to 812 are repeated until the action 712 issimilar enough to the goal 720 (step 814). For example, the transactionamount specified in the goal 720 is $20-$3,000. If the transactionamount of each transaction in the action 712 falls within the range of$20-$3,000, then the action 712 is similar enough to the goal 720.

Since the standard customer transaction data 106 may include abnormaldata, e.g., a fraudulent transaction, the simulated customer transactiondata 108 may also include abnormal data, because the simulated customertransaction data 108 is similar to the standard customer transactiondata 106. In reinforcement learning model, the intelligent agent 702explores the environment 704 randomly or stochastically, learns a policyfrom its experiences, and updates the policy as it explores to improvethe behavior (i.e., transaction) of the intelligent agent 702. In anembodiment, a behavioral pattern (e.g., spending “splurges” untilrunning out of savings, or experiencing “buyer's remorse” on one bigpurchase, etc.), as opposed to random actions, may emerge during RNGbased exploration. An abnormal behavioral pattern may indicate afraudulent transaction. For example, a simulated customer James Culleymay generally make transactions having a transaction amount below$1,000. Suddenly, there is a transaction having a transaction amount of$5,000, and this suspicious transaction may be a fraudulent transaction(e.g., the credit card of James Culley is stolen, or the checkingaccount of James Culley is hacked).

There is a behavioral pattern that naturally emerges during exploration.For example, as shown in FIG. 9, the simulated customer James Culleyreceived an amount of $12,387.71 in a checking account on Jan. 1, 2014.James Culley spent $474.98 on Jan. 9, 2014, $4,400 on Jan. 31, 2014 and$3,856.55 on Mar. 2, 2014 through a debit card associated with thechecking account. In the next Month, James Culley received an amount of$12,387.71 in the checking account on Feb. 1, 2014. James Culley spent$4,500 on Feb. 2, 2014, and $1,713.91 on February 3 through the debitcard associated with the checking account, and transferred $8,100 out ofthe checking account on Jun. 27, 2014. In this example, this simulatedcustomer James Culley has a tendency of save-and-spend, and occasionallyhas a big purchase. The behavioral pattern makes this simulated customerJames Culley behave more realistically (i.e., look more like a realcustomer, rather than a robot). A plurality of parameters, such as“behavioral consistency” (the degree of behavioral consistency in aperiod of time), “consistency volatility” (frequency of behaviorchange), “behavior abnormality” (deviation from regular transactionbehaviors), etc. are generated by the policy engine 706, and used toshow a different personality of each simulated customer.

The transaction data simulator 110 uses abstracted or aggregated realcustomer data to simulate customer data that is representative of realcustomers. The transaction data simulator 110 can provide a large set ofsimulated customer data (i.e., simulated transaction data in combinationwith an artificial customer profile) that can be used to train apredictive model for detecting abnormal customer behaviors. Further, thesimulated customer data is generated based on abstracted data of thereal raw customer data, rather than the real raw customer data itself,and thus it is impossible to derive actual transaction actions of anyreal customer. Additionally, the transaction data simulator 110 allowsgeneration of a behavioral pattern for each simulated customer duringiterations.

The system and processes of the figures are not exclusive. Othersystems, processes, and menus may be derived in accordance with theprinciples of embodiments described herein to accomplish the sameobjectives. It is to be understood that the embodiments and variationsshown and described herein are for illustration purposes only.Modifications to the current design may be implemented by those skilledin the art, without departing from the scope of the embodiments. Asdescribed herein, the various systems, subsystems, agents, managers, andprocesses can be implemented using hardware components, softwarecomponents, and/or combinations thereof. No claim element herein is tobe construed under the provisions of 35 U.S.C. 112 (f), unless theelement is expressly recited using the phrase “means for.”

The present invention may be a system, a method, and/or a computerprogram product. The computer program product may include a computerreadable storage medium (or media) having computer readable programinstructions thereon for causing a processor to carry out aspects of thepresent invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a head disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network(LAN), a wide area network (WAN), and/or a wireless network. The networkmay comprise copper transmission cables, optical transmission fibers,wireless transmission, routers, firewalls, switches, gateway computers,and/or edge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either source code or object code written in anycombination of one or more programming languages, including anobject-oriented programming language such as Java™, Smalltalk, C++ orthe like, and conventional procedural programming languages, such as the“C” programming language or similar programming languages. The computerreadable program instructions may execute entirely on the user'scomputer, partly on the user's computer, as a stand-alone softwarepackage, partly on the user's computer and partly on a remote computer,or entirely on the remote computer or server. In the latter scenario,the remote computer may be connected to the user's computer through anytype of network, including LAN or WAN, or the connection may be made toan external computer (for example, through the Internet using anInternet Service Provider). In some embodiments, electronic circuitryincluding, for example, programmable logic circuitry, field-programmablegate arrays (FPGA), or programmable logic arrays (PLA) may execute thecomputer readable program instructions by utilizing state information ofthe computer readable program instructions to personalize the electroniccircuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatuses(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operations steps to be performed on the computer,other programmable apparatus, or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical functions. In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The present description and claims may make use of the terms “a,” “atleast one of,” and “one or more of,” with regard to particular featuresand elements of the illustrative embodiments. It should be appreciatedthat these terms and phrases are intended to state that there is atleast one of the particular feature or element present in the particularillustrative embodiment, but that more than one can also be present.That is, these terms/phrases are not intended to limit the descriptionor claims to a single feature/element being present or require that aplurality of such features/elements be present. To the contrary, theseterms/phrases only require at least a single feature/element with thepossibility of a plurality of such features/elements being within thescope of the description and claims.

In addition, it should be appreciated that the following descriptionuses a plurality of various examples for various elements of theillustrative embodiments to further illustrate example implementationsof the illustrative embodiments and to aid in the understanding of themechanisms of the illustrative embodiments. These examples are intendedto be non-limiting and are not exhaustive of the various possibilitiesfor implementing the mechanisms of the illustrative embodiments. It willbe apparent to those of ordinary skill in the art in view of the presentdescription that there are many other alternative implementations forthese various elements that may be utilized in addition to, or inreplacement of, the example provided herein without departing from thespirit and scope of the present invention.

Although the invention has been described with reference to exemplaryembodiments, it is not limited thereto. Those skilled in the art willappreciate that numerous changes and modifications may be made to thepreferred embodiments of the invention and that such changes andmodifications may be made without departing from the true spirit of theinvention. It is therefore intended that the appended claims beconstrued to cover all such equivalent variations as fall within thetrue spirit and scope of the invention.

We claim:
 1. A computer-implemented method for generating a standardcustomer profile in a data processing system comprising a processingdevice and a memory comprising instructions which are executed by theprocessing device, the method comprising: receiving customer data from aplurality of computing devices over a network, the customer dataincluding information for a plurality of customers to a plurality ofentities; performing, by the processing device, unsupervised learning onthe customer data to produce a plurality of clusters of customers with aplurality of features in common; determining, by the processing device,that a cluster represents a standard customer and storing a plurality ofstandard customer profiles based on the determined standard customers;providing the plurality of standard customer profiles to a cognitivesystem for generating synthetic transaction data based on the standardcustomer; generating, by the processing device, a detection model fordetecting activity based on the synthetic transaction data; anddistributing the detection model to each of the computing devices overthe network.
 2. The method of claim 1, wherein the information for theplurality of customers comprises identifying information and transactioninformation.
 3. The method of claim 1, further comprising filtering thecustomer data prior to performing unsupervised learning.
 4. The methodof claim 3, wherein the filtering comprises an RFM analysis to groupcustomers.
 5. The method of claim 1, wherein the standard customerprofiles comprise a plurality of data distributions for the plurality offeatures in common.
 6. The method of claim 1, wherein determining that asub-cluster represents a standard customer comprises applying one ormore rules.
 7. The method of claim 6, wherein the one or more rulescomprise a size determination indicating a minimum or maximum number ofcustomers in a sub-cluster that is determined to be a standard customer.8. An abstraction system comprising a processing device and a memorycomprising instructions which are executed by the processing device forgenerating a standard customer profile in a data processing systemconfigured to: receiving customer data from a plurality of computingdevices over a network, the customer data including information for aplurality of customers to a plurality of entities; performing, by theprocessing device, unsupervised learning on the customer data to producea plurality of clusters of customers with a plurality of features incommon; determining, by the processing device, that a cluster representsa standard customer and storing a plurality of standard customerprofiles based on the determined standard customers; providing theplurality of standard customer profiles to a cognitive system forgenerating synthetic transaction data based on the standard customer;generating, by the processing device, a detection model for detectingactivity based on the synthetic transaction data; and distributing thedetection model to each of the computing devices over the network. 9.The method of claim 8, wherein the information for the plurality ofcustomers comprises identifying information and transaction information.10. The method of claim 8, further comprising filtering the customerdata prior to performing unsupervised learning.
 11. The method of claim10, wherein the filtering comprises an RFM analysis to group customers.12. The method of claim 8, wherein the standard customer profilescomprise a plurality of data distributions for the plurality of featuresin common.
 13. The method of claim 8, wherein determining that asub-cluster represents a standard customer comprises applying one ormore rules.
 14. The method of claim 13, wherein the one or more rulescomprise a size determination indicating a minimum or maximum number ofcustomers in a sub-cluster that is determined to be a standard customer.15. A computer program product comprising software that when executed bya processor performs a method comprising: receiving customer data from aplurality of computing devices over a network, the customer dataincluding information for a plurality of customers to a plurality ofentities; performing, by the processing device, unsupervised learning onthe customer data to produce a plurality of clusters of customers with aplurality of features in common; determining, by the processing device,that a cluster represents a standard customer and storing a plurality ofstandard customer profiles based on the determined standard customers;providing the plurality of standard customer profiles to a cognitivesystem for generating synthetic transaction data based on the standardcustomer; generating, by the processing device, a detection model fordetecting activity based on the synthetic transaction data; anddistributing the detection model to each of the computing devices overthe network.
 16. The method of claim 15, wherein the information for theplurality of customers comprises identifying information and transactioninformation.
 17. The method of claim 15, further comprising filteringthe customer data prior to performing unsupervised learning.
 18. Themethod of claim 17, wherein the filtering comprises an RFM analysis togroup customers.
 19. The method of claim 15, wherein the standardcustomer profiles comprise a plurality of data distributions for theplurality of features in common.
 20. The method of claim 15, whereindetermining that a sub-cluster represents a standard customer comprisesapplying one or more rules.
 21. The method of claim 20, wherein the oneor more rules comprise a size determination indicating a minimum ormaximum number of customers in a sub-cluster that is determined to be astandard customer.